@polderlabs/bizar 10.7.0 → 10.7.2

package/.claude/hooks/pretooluse-bash.mjs

@@ -0,0 +1,87 @@
+#!/usr/bin/env node
+/**
+ * pretooluse-bash.mjs — Claude Code PreToolUse hook (matcher: Bash).
+ *
+ * Runs the Bizar dangerous-pattern scanner on Bash commands before they
+ * execute. Blocks destructive patterns (rm -rf, sudo, SSRF, etc.) via
+ * the 36-pattern DANGEROUS_PATTERNS regex list maintained in
+ * `@polderlabs/bizar-sdk/dist/dangerous-patterns.js`.
+ *
+ * Claude Code PreToolUse input schema:
+ *   { session_id, cwd, hook_event_name: "PreToolUse", tool_name: "Bash", tool_input: { command, description } }
+ *
+ * Claude Code PreToolUse output schema:
+ *   { hookSpecificOutput: { hookEventName, permissionDecision, permissionDecisionReason }, additionalContext? }
+ */
+
+'use strict';
+
+let raw = '';
+process.stdin.setEncoding('utf8');
+process.stdin.on('data', (chunk) => { raw += chunk; });
+process.stdin.on('end', () => {
+  let input = {};
+  try { input = JSON.parse(raw); } catch { input = {}; }
+  const toolInput = (input.tool_input && typeof input.tool_input === 'object') ? input.tool_input : {};
+  const command = String(toolInput.command || '');
+
+  // Inline dangerous-pattern scanner. Mirrors
+  // `packages/sdk/src/dangerous-patterns.ts` — kept inline so this hook
+  // works without importing the SDK at runtime.
+  // For the `rm` family, the path argument must be EXACTLY the dangerous
+  // root — not a prefix of a deeper path. `/home/drb0rk/projects/foo.mjs`
+  // is a legitimate delete, not "wipe home directory". The old patterns
+  // matched any path STARTING with `/home` and so blocked every file
+  // delete under the project root (false positive).
+  const DANGEROUS = [
+    { name: 'rm-rf-root',       pattern: /\brm\s+(-\w*r\w*f\w*\s+)*\/(?:\s|$|;|\|)/i, decision: 'deny', reason: 'Recursive delete of root filesystem' },
+    { name: 'rm-rf-system',      pattern: /\brm\s+(-\w*r\w*f\w*\s+)*\/(?:etc|var|usr|boot)\b(?:\s|$|;|\|)/i, decision: 'deny', reason: 'Recursive delete of system directory' },
+    { name: 'rm-rf-wildcard',    pattern: /\brm\s+-\w*r\w*f\w*\s+\*/i, decision: 'ask', reason: 'Recursive delete with wildcard' },
+    { name: 'rm-rf-home',        pattern: /\brm\s+(-\w*r\w*f\w*\s+)*~?\/(?:\s|$|;|\|)/i, decision: 'ask', reason: 'Recursive delete of home directory' },
+    { name: 'rm-rf-home-exact',  pattern: /\brm\s+(-\w*r\w*f\w*\s+)*\/home(?:\s|$|;|\|)/i, decision: 'ask', reason: 'Recursive delete of /home (the directory, not a sub-path)' },
+    { name: 'mkfs', pattern: /\bmkfs(\.\w+)?\s+\/dev\//i, decision: 'deny', reason: 'Format filesystem' },
+    { name: 'dd-of-dev', pattern: /\bdd\s+.*of=\/dev\//i, decision: 'deny', reason: 'dd to raw device' },
+    { name: 'sudo', pattern: /(^|\s|;|&&|\|\|)sudo\b/i, decision: 'ask', reason: 'Sudo escalation' },
+    { name: 'su-root', pattern: /\bsu\s+-?\s*root\b/i, decision: 'ask', reason: 'su to root' },
+    { name: 'curl-metadata', pattern: /169\.254\.169\.254/i, decision: 'deny', reason: 'AWS metadata IP' },
+    { name: 'curl-google-metadata', pattern: /metadata\.google\.internal/i, decision: 'deny', reason: 'GCP metadata hostname' },
+    { name: 'curl-azure-metadata', pattern: /metadata\.azure\.com/i, decision: 'deny', reason: 'Azure metadata hostname' },
+    { name: 'nc-backdoor', pattern: /\bnc\s+(-[a-z]*\s+)*-[a-z]*e\b/i, decision: 'deny', reason: 'nc execute backdoor' },
+    { name: 'wget-pipe-shell', pattern: /\bwget\s+.*\|\s*(ba)?sh\b/i, decision: 'deny', reason: 'wget piped to shell' },
+    { name: 'curl-pipe-shell', pattern: /\bcurl\s+.*\|\s*(ba)?sh\b/i, decision: 'deny', reason: 'curl piped to shell' },
+    { name: 'kill-init', pattern: /\bkill\s+(-9\s+)?1\b/i, decision: 'deny', reason: 'Kill PID 1 (init)' },
+    { name: 'shutdown', pattern: /\b(shutdown|halt|poweroff|reboot)\b/i, decision: 'deny', reason: 'System shutdown' },
+    { name: 'xmrig', pattern: /\b(xmrig|minerd|cpuminer|cgminer)\b/i, decision: 'deny', reason: 'Crypto miner' },
+    { name: 'read-shadow', pattern: /\/etc\/(shadow|passwd|sudoers)\b/i, decision: 'ask', reason: 'Read sensitive system file' },
+    { name: 'read-ssh', pattern: /\.ssh\//i, decision: 'deny', reason: 'Read SSH keys' },
+    { name: 'read-aws-creds', pattern: /~\/\.aws\/credentials/i, decision: 'deny', reason: 'Read AWS credentials' },
+    { name: 'path-traversal', pattern: /(\.\.\/){2,}/i, decision: 'ask', reason: 'Multiple path traversal' },
+    { name: 'git-force-push-main', pattern: /\bgit\s+push\s+(-f|--force)(\s+--.*)?\s+origin\s+(main|master)\b/i, decision: 'deny', reason: 'Force push to main/master' },
+    { name: 'git-reset-hard', pattern: /\bgit\s+reset\s+--hard\b/i, decision: 'ask', reason: 'git reset --hard' },
+  ];
+
+  for (const p of DANGEROUS) {
+    if (p.pattern.test(command)) {
+      const decision = p.decision === 'deny' ? 'deny' : 'ask';
+      const out = {
+        hookSpecificOutput: {
+          hookEventName: 'PreToolUse',
+          permissionDecision: decision,
+          permissionDecisionReason: `dangerous_pattern:${p.name}: ${p.reason}`,
+        },
+      };
+      process.stdout.write(JSON.stringify(out) + '\n');
+      return;
+    }
+  }
+
+  // No dangerous pattern — allow.
+  const out = {
+    hookSpecificOutput: {
+      hookEventName: 'PreToolUse',
+      permissionDecision: 'allow',
+    },
+    additionalContext: `Bizar PreToolUse(Bash): scanned ${command.length} chars, no dangerous pattern.`,
+  };
+  process.stdout.write(JSON.stringify(out) + '\n');
+});

package/.claude/hooks/pretooluse-editwrite.mjs

@@ -0,0 +1,117 @@
+#!/usr/bin/env node
+// PreToolUse — Bizar harness hook (Claude Code format).
+//
+// Runs BEFORE any tool call against `Write`, `Edit`, or `MultiEdit`.
+// (Bash is handled by `pretooluse-bash.mjs`, registered separately.)
+//
+// Claude Code stdin shape:
+//   {
+//     "session_id": "...",
+//     "transcript_path": "...",
+//     "cwd": "...",
+//     "hook_event_name": "PreToolUse",
+//     "tool_name": "Write",
+//     "tool_input": { "file_path": "...", "content": "..." }
+//   }
+//
+// Claude Code stdout shape:
+//   { "hookSpecificOutput": {
+//       "hookEventName": "PreToolUse",
+//       "permissionDecision": "deny",
+//       "permissionDecisionReason": "..."
+//   }}
+//   ── or ──
+//   { "hookSpecificOutput": {
+//       "hookEventName": "PreToolUse",
+//       "additionalContext": "note for the model"
+//   }}
+//
+// Behaviour:
+//   1. Block writes to .env, .envrc, secrets/, credentials/, node_modules/.
+//      .env.example/.sample/.template are explicitly allowed (docs, not
+//      secrets). Lockfiles are allowed — they're package-manager output.
+//   2. Always return a small context line for the next AI decision.
+//      (console.log / debugger / .only() are enforced by `make clean-check`
+//      at commit time — duplicate-warning here adds noise without safety.)
+
+'use strict';
+
+let raw = '';
+process.stdin.setEncoding('utf8');
+process.stdin.on('data', (chunk) => { raw += chunk; });
+process.stdin.on('end', () => {
+  let input = {};
+  try { input = JSON.parse(raw || '{}'); } catch { input = {}; }
+
+  const toolName = String(input.tool_name || '');
+  const toolInput =
+    (input.tool_input && typeof input.tool_input === 'object') ? input.tool_input : {};
+
+  // Extract the "file_path" mapped onto Claude Code's Write/Edit/MultiEdit
+  // shapes. Content scanning was removed (debug artifacts are enforced at
+  // commit time via `make clean-check`, not write time).
+  let filePath = '';
+  if (toolName === 'Write') {
+    filePath = String(toolInput.file_path || '');
+  } else if (toolName === 'Edit') {
+    filePath = String(toolInput.file_path || '');
+  } else if (toolName === 'MultiEdit') {
+    filePath = String(toolInput.file_path || '');
+  } else {
+    process.stdout.write('{}\n');
+    return;
+  }
+
+  const lowerPath = filePath.toLowerCase();
+
+  // 1. Hard block — secrets + protected paths. .env.example/.sample/.template
+  //    and all lockfiles are explicitly allowed (docs / package-manager output).
+  const allowed = [
+    /\/\.env\.(example|sample|template|dist)$/i,
+    /\/(package-lock|yarn|pnpm-lock|bun)\.lock\w*$/i,
+    /\.(lock|lockb)$/i,
+  ];
+
+  const blocked = [
+    /\/\.envrc$/,
+    /\/\.env(\.[a-z0-9_-]+)?$/i,
+    /\/secrets?\//,
+    /\/credentials?\//,
+    /\/node_modules\//,
+  ];
+
+  const isAllowed = filePath && allowed.some((re) => re.test(lowerPath));
+  let blockReason = '';
+  if (filePath && !isAllowed && blocked.some((re) => re.test(lowerPath))) {
+    blockReason = filePath;
+  }
+
+  if (blockReason) {
+    const out = {
+      hookSpecificOutput: {
+        hookEventName: 'PreToolUse',
+        permissionDecision: 'deny',
+        permissionDecisionReason:
+          `Bizar PreToolUse: refusing to write to protected path '${blockReason}' (Bizar harness policy).`,
+      },
+    };
+    process.stdout.write(JSON.stringify(out) + '\n');
+    return;
+  }
+
+  // 2. Always add a small context line for the AI's next decision.
+  //    Debug-artifact warnings (console.log / debugger / .only()) live in
+  //    `make clean-check` — duplicating them here would add noise without
+  //    adding safety (they're caught at commit time, not write time).
+  const notes = [
+    `Bizar PreToolUse: tool=${toolName || 'unknown'} path=${filePath || '(no path)'}`,
+  ];
+
+  const out = {
+    hookSpecificOutput: {
+      hookEventName: 'PreToolUse',
+      additionalContext: notes.join(' '),
+    },
+  };
+  process.stdout.write(JSON.stringify(out) + '\n');
+});

package/.claude/hooks/sessionend-recall.mjs

@@ -0,0 +1,384 @@
+#!/usr/bin/env node
+/**
+ * sessionend-recall.mjs — Claude Code SessionEnd hook.
+ *
+ * Captures what actually happened in the session so the next session
+ * (and the user, in `.bizar/sessions/`) can pick up where we left off.
+ *
+ * Reads `transcript_path` (JSONL), extracts:
+ *   - last user prompt (what was being worked on)
+ *   - files written/edited (from tool_use blocks)
+ *   - bash commands run
+ *   - error patterns (ENOENT / EACCES / permission / TypeError / unhandledrejection)
+ *   - tool-call counts
+ *   - wall-clock span
+ *
+ * Writes:
+ *   1. .bizar/sessions/<date>-<id>.md  — markdown note with structured frontmatter
+ *   2. .bizar/session-state.json       — ≤ 1KB handoff for the next SessionStart
+ *
+ * Claude Code SessionEnd input:
+ *   { session_id, transcript_path, cwd, hook_event_name, reason }
+ *
+ * Claude Code SessionEnd output:
+ *   {}  (silence is fine — the artifact is the file system)
+ *
+ * Always exits 0.
+ */
+
+'use strict';
+
+import { readFileSync, existsSync, mkdirSync, writeFileSync, appendFileSync } from 'node:fs';
+import { join } from 'node:path';
+import os from 'node:os';
+
+const SESSIONS_DIR = '.bizar/sessions';
+const SESSION_STATE = '.bizar/session-state.json';
+const HOOK_LOG_DIR = '.config/bizar/hook-logs';
+const MAX_TRANSCRIPT_LINES = 200; // ~50KB cap
+const MAX_FILES_TRACKED = 20;
+const MAX_BLOCKERS = 5;
+const ERROR_PATTERNS = [
+  /Error: ENOENT/i,
+  /Error: EACCES/i,
+  /Error: EPERM/i,
+  /permission denied/i,
+  /command not found/i,
+  /TypeError:/i,
+  /ReferenceError:/i,
+  /SyntaxError:/i,
+  /unhandledrejection/i,
+  /Cannot find module/i,
+  /MODULE_NOT_FOUND/i,
+  /fatal: /i,
+];
+
+// ── Transcript parsing ─────────────────────────────────────────────────────
+
+function readTranscript(transcriptPath) {
+  if (!transcriptPath || !existsSync(transcriptPath)) return [];
+  let text = '';
+  try {
+    text = readFileSync(transcriptPath, 'utf8');
+  } catch {
+    return [];
+  }
+  const all = text.split('\n').filter(Boolean);
+  const tail = all.slice(-MAX_TRANSCRIPT_LINES);
+
+  const events = [];
+  for (const line of tail) {
+    try {
+      const obj = JSON.parse(line);
+      if (obj && typeof obj === 'object') events.push(obj);
+    } catch {
+      /* skip malformed lines */
+    }
+  }
+  return events;
+}
+
+const FILLER_PROMPTS = /^\s*(continue|go on|keep going|yes|ok|okay|sure|do it|proceed|yeah|yep)\s*[.!]?\s*$/i;
+
+function isFiller(s) {
+  return typeof s === 'string' && FILLER_PROMPTS.test(s);
+}
+
+function scanForErrors(text) {
+  if (!text || typeof text !== 'string') return [];
+  const hits = [];
+  for (const pat of ERROR_PATTERNS) {
+    const m = text.match(pat);
+    if (m) hits.push(m[0]);
+    if (hits.length >= MAX_BLOCKERS) break;
+  }
+  return hits;
+}
+
+function extract(events) {
+  const filesTouched = new Set();
+  const bashCommands = [];
+  const errors = [];
+  const toolsUsed = {};
+  const userPrompts = [];
+  let firstTs = null;
+  let lastTs = null;
+
+  function bumpTool(name) {
+    if (!name) return;
+    toolsUsed[name] = (toolsUsed[name] || 0) + 1;
+  }
+
+  function recordError(text) {
+    if (!text) return;
+    for (const e of scanForErrors(text)) {
+      if (!errors.includes(e)) errors.push(e);
+      if (errors.length >= MAX_BLOCKERS) break;
+    }
+  }
+
+  for (const ev of events) {
+    const ts = ev.timestamp || ev.ts;
+    if (typeof ts === 'string' || typeof ts === 'number') {
+      if (!firstTs) firstTs = ts;
+      lastTs = ts;
+    }
+
+    const msg = ev.message || ev;
+    const role = msg && msg.role;
+    const content = msg && msg.content;
+
+    if (role === 'user' && typeof content === 'string') {
+      userPrompts.push(content);
+    }
+
+    if (Array.isArray(content)) {
+      for (const block of content) {
+        if (!block || typeof block !== 'object') continue;
+        const type = block.type;
+        if (type === 'tool_use' || type === 'toolCall') {
+          const name = block.name || block.tool_name || 'unknown';
+          bumpTool(name);
+          const input = block.input || block.tool_input || {};
+          if (input && typeof input === 'object') {
+            const fp = input.file_path || input.path;
+            if (fp && typeof fp === 'string') filesTouched.add(fp);
+            const cmd = input.command;
+            if (cmd && typeof cmd === 'string') {
+              bashCommands.push(cmd);
+            }
+          }
+        }
+        if (type === 'tool_result' || type === 'toolResult') {
+          const out = block.content || block.output;
+          if (typeof out === 'string') recordError(out);
+          else if (Array.isArray(out)) {
+            for (const sub of out) {
+              if (typeof sub === 'string') recordError(sub);
+              else if (sub && typeof sub === 'object' && typeof sub.text === 'string') {
+                recordError(sub.text);
+              }
+            }
+          }
+        }
+        if (type === 'text' && typeof block.text === 'string') {
+          recordError(block.text);
+        }
+      }
+    }
+  }
+
+  // Pick the most substantive user prompt: longest non-filler, else last.
+  let best = '';
+  for (const p of userPrompts) {
+    if (isFiller(p)) continue;
+    if (p.length > best.length) best = p;
+  }
+  if (!best && userPrompts.length > 0) best = userPrompts[userPrompts.length - 1];
+
+  return {
+    lastUserPrompt: clip(best, 240),
+    filesTouched: [...filesTouched].slice(0, MAX_FILES_TRACKED),
+    bashCommands: bashCommands.slice(-10),
+    errors: errors.slice(0, MAX_BLOCKERS),
+    toolsUsed,
+    firstTs,
+    lastTs,
+  };
+}
+
+function clip(s, n) {
+  if (!s) return '';
+  const oneLine = String(s).replace(/\s+/g, ' ').trim();
+  return oneLine.length <= n ? oneLine : oneLine.slice(0, n - 1) + '…';
+}
+
+function detectActiveFeature(cwd) {
+  const path = join(cwd, 'feature_list.json');
+  if (!existsSync(path)) return null;
+  try {
+    const data = JSON.parse(readFileSync(path, 'utf8'));
+    const active = (data.features || []).filter((f) => f && f.state === 'active');
+    if (active.length === 1) return active[0].id;
+    if (active.length > 1) return active.map((a) => a.id).join(',');
+    return null;
+  } catch {
+    return null;
+  }
+}
+
+function inferNextStep(summary, activeFeature) {
+  if (summary.errors.length > 0) return `Resolve ${summary.errors[0]} from the prior session.`;
+  if (!activeFeature && !summary.lastUserPrompt) {
+    return 'Pick next feature from feature_list.json not_started.';
+  }
+  if (summary.lastUserPrompt) return `Resume: ${clip(summary.lastUserPrompt, 100)}`;
+  return `Continue with ${activeFeature}.`;
+}
+
+// ── File writers ───────────────────────────────────────────────────────────
+
+function writeSessionNote(cwd, sessionId, reason, summary) {
+  const today = new Date().toISOString().slice(0, 10);
+  const projectName = cwd.split('/').pop() || 'unknown';
+  const dir = join(cwd, SESSIONS_DIR);
+  try {
+    mkdirSync(dir, { recursive: true });
+  } catch {
+    return null;
+  }
+  const fileName = `${today}-${sessionId.slice(0, 8)}.md`;
+  const notePath = join(dir, fileName);
+
+  const activeFeature = detectActiveFeature(cwd);
+  const frontmatter = [
+    '---',
+    `title: Session ${today} ${sessionId.slice(0, 8)}`,
+    `createdAt: ${new Date().toISOString()}`,
+    `sessionId: ${sessionId}`,
+    `reason: ${reason}`,
+    `cwd: ${cwd}`,
+    activeFeature ? `activeFeature: ${activeFeature}` : 'activeFeature: null',
+    `toolsUsed: ${JSON.stringify(summary.toolsUsed)}`,
+    summary.filesTouched.length > 0
+      ? `filesTouched: [${summary.filesTouched.map((f) => `"${f.replace(/"/g, '\\"')}"`).join(', ')}]`
+      : 'filesTouched: []',
+    summary.errors.length > 0
+      ? `blockers: [${summary.errors.map((e) => `"${e.replace(/"/g, '\\"')}"`).join(', ')}]`
+      : 'blockers: []',
+    `tags: [session, auto-generated]`,
+    '---',
+  ].join('\n');
+
+  const body = [
+    '',
+    `# Session ${today} (${sessionId.slice(0, 8)})`,
+    '',
+    `Session ended with reason: \`${reason}\`.`,
+    '',
+    `Working directory: \`${cwd}\``,
+    '',
+    '## Last user prompt',
+    '',
+    summary.lastUserPrompt
+      ? `> ${summary.lastUserPrompt.replace(/\n/g, ' ')}`
+      : '_No user prompts captured in transcript._',
+    '',
+    '## Files touched',
+    '',
+    summary.filesTouched.length > 0
+      ? summary.filesTouched.map((f) => `- \`${f}\``).join('\n')
+      : '_No file writes captured._',
+    '',
+    '## Tools used',
+    '',
+    Object.entries(summary.toolsUsed)
+      .sort((a, b) => b[1] - a[1])
+      .map(([t, n]) => `- \`${t}\` × ${n}`)
+      .join('\n') || '_none_',
+    '',
+    '## Errors / blockers',
+    '',
+    summary.errors.length > 0
+      ? summary.errors.map((e) => `- \`${e}\``).join('\n')
+      : '_None captured._',
+    '',
+  ].join('\n');
+
+  try {
+    writeFileSync(notePath, frontmatter + body + '\n', 'utf8');
+    return notePath;
+  } catch {
+    return null;
+  }
+}
+
+function writeSessionState(cwd, sessionId, reason, summary, nextStep) {
+  const path = join(cwd, SESSION_STATE);
+  try {
+    mkdirSync(join(cwd, '.bizar'), { recursive: true });
+  } catch {
+    /* best-effort */
+  }
+  const state = {
+    lastSessionId: sessionId,
+    lastSessionEnd: new Date().toISOString(),
+    reason,
+    activeFeature: detectActiveFeature(cwd),
+    nextStep,
+    filesTouched: summary.filesTouched,
+    blockers: summary.errors,
+    toolsUsed: summary.toolsUsed,
+  };
+  try {
+    writeFileSync(path, JSON.stringify(state, null, 2), 'utf8');
+    return true;
+  } catch {
+    return false;
+  }
+}
+
+function logLifecycle(sessionId, reason, cwd) {
+  try {
+    const dir = join(cwd || process.cwd(), HOOK_LOG_DIR);
+    mkdirSync(dir, { recursive: true });
+    const today = new Date().toISOString().slice(0, 10);
+    const logFile = join(dir, `session-end-${today}.jsonl`);
+    appendFileSync(
+      logFile,
+      JSON.stringify({
+        ts: new Date().toISOString(),
+        sessionId,
+        reason,
+        cwd,
+      }) + '\n',
+    );
+  } catch {
+    /* best-effort */
+  }
+}
+
+// ── Main ───────────────────────────────────────────────────────────────────
+
+let errors = [];
+
+let raw = '';
+process.stdin.setEncoding('utf8');
+process.stdin.on('data', (chunk) => {
+  raw += chunk;
+});
+process.stdin.on('end', () => {
+  let input = {};
+  try {
+    input = JSON.parse(raw || '{}');
+  } catch {
+    input = {};
+  }
+
+  const sessionId = String(input.session_id || 'unknown');
+  const reason = String(input.reason || 'unknown');
+  const cwd = String(input.cwd || process.cwd());
+  const transcript = input.transcript_path;
+
+  logLifecycle(sessionId, reason, cwd);
+
+  const events = readTranscript(transcript);
+  const summary = extract(events);
+  errors = summary.errors;
+
+  const nextStep = inferNextStep(summary, detectActiveFeature(cwd));
+  const notePath = writeSessionNote(cwd, sessionId, reason, summary);
+  const stateOk = writeSessionState(cwd, sessionId, reason, summary, nextStep);
+
+  // Silent success — the artifact is the file system.
+  process.stdout.write(
+    JSON.stringify({
+      continue: true,
+      noteWritten: notePath || null,
+      stateWritten: stateOk,
+      toolsUsed: summary.toolsUsed,
+      filesTouched: summary.filesTouched.length,
+      blockers: summary.errors.length,
+    }) + '\n',
+  );
+});